B501 and B113 skip requests.request(), while httpx.request() is checked

Describe the bug

B501 (request_with_no_cert_validation) and B113 (request_without_timeout) both match httpx.request(...), but on the requests side they only match the seven verb helpers:

HTTP_VERBS = {"get", "options", "head", "post", "put", "patch", "delete"}
HTTPX_ATTRS = {"request", "stream", "Client", "AsyncClient"} | HTTP_VERBS

requests.request() is the documented generic form of requests.get() and friends, so it is skipped by both checks. For B501 that means a call which explicitly disables TLS certificate validation goes unreported by a HIGH severity check.

Reproduction

import httpx
import requests

httpx.request("GET", "https://example.com", verify=False)      # line 4
httpx.request("GET", "https://example.com", timeout=None)      # line 5

requests.request("GET", "https://example.com", verify=False)   # line 7
requests.request("GET", "https://example.com", timeout=None)   # line 8

$ bandit probe.py -f custom --msg-template "{line}: {test_id} {msg}"
4: B501 Call to httpx with verify=False disabling SSL certificate checks, security issue.
5: B113 Call to httpx with timeout set to None

Lines 7 and 8 produce nothing. The requests calls are the ones that matter more here — requests has no default timeout, whereas httpx defaults to 5 seconds.

A second file showing the contrast against the verb helpers:

import requests

requests.request("GET", "https://example.com", verify=False)  # line 4 - not reported
requests.request("GET", "https://example.com")                # line 5 - not reported
requests.get("https://example.com", verify=False)             # line 8 - B501 + B113
requests.get("https://example.com")                           # line 9 - B113

9: B501 Call to requests with verify=False disabling SSL certificate checks, security issue.
9: B113 Call to requests without timeout
10: B113 Call to requests without timeout

Expected behavior

requests.request(...) should be treated like the verb helpers by both checks, as httpx.request(...) already is.

Note the httpx-only difference in B113 looks deliberate and should stay: httpx defaults to a 5 second timeout, so only an explicit timeout=None is a problem there, which is exactly what the plugin does today.

bandit version

main at 8f23766, Python 3.13 (also present in the released 1.9.x plugins).

Additional context

requests.request appears in neither examples/requests-ssl-verify-disabled.py nor examples/requests-missing-timeout.py, while httpx.request appears in the first — which is why the gap went unnoticed. I have a PR ready that matches request on the requests side and extends both example files so the functional tests cover it.

Run the supplied reproductions with the B501 and B113 checks, then inspect the handling of request calls and the named examples/requests-ssl-verify-disabled.py and examples/requests-missing-timeout.py files. Done means requests.request() is covered like the verb helpers, the httpx-specific timeout behavior remains unchanged, and functional tests cover both examples.